UpHeron
All vulnerabilities

Servers and applications

CVE-2023-36459

XSS through oEmbed preview cards

Severity
Medium 6.1
Published
6 Jul 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.5.9, 4.0.5, 4.1.3
Also known as
GHSA-ccm4-vgcc-73hp
Sources
NVD, Project advisories (GitHub)

Description

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker using carefully crafted oEmbed data can bypass the HTML sanitization performed by Mastodon and include arbitrary HTML in oEmbed preview cards. This introduces a vector for cross-site scripting (XSS) payloads that can be rendered in the…

Affected software

SoftwareAffected versions
MastodonServers and applications · cpe:a:joinmastodon:mastodon
  • From 1.3 before 3.5.9
  • From 4.0.0 before 4.0.5
  • From 4.1.0 before 4.1.3
MastodonServers and applications · github:mastodon/mastodon
  • From 1.3 before 3.5.9

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-36459
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-36459
  • GitHub Advisory Database https://github.com/advisories/GHSA-ccm4-vgcc-73hp
  • github.com https://github.com/mastodon/mastodon/security/advisories/GHSA-ccm4-vgcc-73hp